Cybersecurity is not a cost, it's an investment, experts say

Culture of security starts with getting a buy-in from top executives on the importance of protecting information.

Cybersecurity is not part of a hospital's core competency. Executives would much rather be spending money on what hospitals are in the business of doing.

University of California Irvine Health CIO Chuck Podesta knew this when he joined the health system three years ago after working in a similar capacity in Vermont.

So getting the medium-sized academic medical center to invest $7 to $8 million the first year came down to telling the CEO, and other executives, that it would cost them a lot more if the system suffered a data breach.

What executive leadership needs to know is the risk profile of the organization, not the details of how data loss prevention works, he said.

At that time, UC Irvine had an encryption program and policy and procedures in place. Podesta and team hired CynergisTek to do an assessment of the security systems. They found holes that needed to be plugged.

That first year they got that $7 to $8 million and hired Optimum Health to do a remediation plan.

In 2015, healthcare had the dubious distinction of experiencing seven large data breaches. In February, Anthem had the largest breach, affecting the data of more than 80 million people. Breaches were also reported by Excellus BlueCross BlueShield and Premera Blue Cross.

In fact, the wave of breaches led UC Irvine to speed up the timeline of their remediation plan from one year to four months.

CynergisTek's Vice President of Security Strategies Clyde Hewitt said sometimes it's a hard to sell the heads of health systems on the benefit of budgeting cybersecurity. They may feel they're up-to-date, but if the hospital's last update was done in 2003, it's out-of-date.

"The cyber threats we're dealing with today are radically different," Hewitt said. "In 2003 we were worried about hackers. We've moved so far beyond that. Now there's cyber terrorism."

Health systems look to HIPAA law for compliance, but that privacy law went into effect in 1996.

"There needs to be a recognition this is not a cost, but an investment," Hewitt said.

If through a cyber attack the system loses its data, it must have the financial reserves and cash flow to deal with potentially not being able to bill patients. It will impact their accounts receivable, Hewitt said.

UC Irvine installed a spam filter to catch ransomware phishing attacks. It put in data loss prevention software to map where the protected information is located. And it added improved spam filters around email.

The health system also invested in education for staff.

Through mock phishing attempts, they managed to lower the rate employees opened malicious emails from 20 percent to 2 percent.

"We put in a robust spam tool when the ransomware came out," Podesta said. "It's a struggle, you got to keep ahead of the bad guys."

Hewitt said, "I think a lot of hospitals focus on hospitals and external threats. If you look at the number of breaches, a large percentage start with actions from people inside. It's not because it's malicious. It's because people get rushed."

UC Irvine works with four other medical centers within UC Health, though security is still handled separately. The medical centers are using CynergisTek for their assessments and agreed to purchase Cisco for their security IT networks, which has led to greater alignment on security programs.

The next step will be to install a product that can alert systems on the West Coast if there's a problem on the East Coast.

Podesta started with two people on staff. Now he has five.

"We're still short," he said. "I could easily find work for another three people."

UC Irvine suffered a small data breach about six months into Podesta's tenure. The breach affected about 3,000 patients. It was caused by an error, not a hack.

Because UC Irvine was able to show work being done through a remediation plan, the system ended up with no finding and no fine.

"We basically showed," Podesta said, "that we had a culture of security across the organization."

Clinical Quality Measures 101Although quality-reporting programs such as meaningful use provide incentives to help providers implement and use electronic health records (EHRs) to collect and report on clinical data, practices often need help deciding what data to collect, which measures to report ...

Credible, Defensible EstimatesIn healthcare, every interaction with the patient matters. Especially in today’s environment of continuous improvement, efforts have been concentrated on coordination among providers, the patient care experience and quality outcomes – all laudable goals.

Debunk the Myth: Outsourcing Doesn't Mean Losing ControlWith shifts in payer mixes and reimbursement structure, the margin of reimbursement has been shrinking steadily over the last five years. How do revenue cycle leaders navigate payment reform while maintaining stable business office operations?

Care Collaboration Success for Improved OutcomesThe nature of our healthcare ecosystem has been one of siloed care. Rarely do payers, providers and local resources come together with the patient's well-being prioritized as a unifying mission. Read how these organizations are getting it right.

Credible, Defensible EstimatesIn healthcare, every interaction with the patient matters. Especially in today’s environment of continuous improvement, efforts have been concentrated on coordination among providers, the patient care experience and quality outcomes – all laudable goals.

Clinical Quality Measures 101Although quality-reporting programs such as meaningful use provide incentives to help providers implement and use electronic health records (EHRs) to collect and report on clinical data, practices often need help deciding what data to collect, which measures to report ...